·
Last changedVersion:
This version passed the hardening gate. Hardening applied 1 targeted change, normalized allowed-tools to the canonical single-string form, and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 0. Classified findings remaining: 6. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 17.
4
2
4
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Sensitive Data & Secret Exposure | Hardcoded secret | Medium | Open | |
references/benchmark-execution.md | Sensitive Data & Secret Exposure | Hardcoded secret | Medium | Open | |
BENCHMARK.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
references/dataset-and-conversion.md | Tool & MCP Manipulation | MCP configuration abuse | Medium | Open | |
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Open | |
SKILL.md | Malicious Code & Command Execution | Command injection | Low | Open |
6 findings
corpus/ + train.json)Guide agents through NVIDIA RAG Blueprint filesystem benchmarks: preparing corpus/ and train.json, running scripts/eval/evaluate_rag.py, tuning retrieval and generation flags for quality comparisons, interpreting RAGAS JSON outputs, and triaging failures (HTTP/stream errors, empty contexts, collection mismatch, judge API).
For latency, throughput, and load testing, use the rag-perf skill (scripts/rag-perf, docs/performance-benchmarking.md) — not this skill.
Do not use this skill for: deploying or repairing services (use rag-blueprint); evaluating APIs without the corpus/ + train.json layout; general ML experimentation unrelated to this evaluator; production monitoring/alerting; or latency/throughput benchmarking (use rag-perf).
uv sync --project scripts/eval.localhost:8081 / 8082).NVIDIA_API_KEY for RAGAS (see credential hygiene); optional RAG_EVAL_JUDGE_MODEL.--dataset-paths each contain corpus/ and train.json.train.json rules in references/dataset-and-conversion.md. When sources arrive as public links (sites or dataset pages), materialize documents under corpus/—prefer PDF for multimodal content so images stay embedded; convert CSV/JSONL/etc. using the patterns there.uv run --project scripts/eval python scripts/eval/evaluate_rag.py with --dataset-paths, --host, and --port. See references/benchmark-execution.md for command examples, outputs, and errors. Use references/evaluate-rag-cli.md for flag-level detail.--top_k / --vdb_top_k, reranker and query-rewriting toggles, and generation overrides (--temperature, --top-p, --max-tokens) as documented in references/benchmark-execution.md when comparing retrieval/generation configs for RAGAS scores.references/result-analysis.md for scripts; scan rag_*_evaluation_summary.json for headline RAGAS metrics.Set API key without putting secrets in shell history (preferred patterns): load from a gitignored env file or secrets manager; avoid committing .env; rotate keys if exposed. Details: references/benchmark-execution.md#credential-hygiene-nvidia_api_key.
Minimal eval (key already in environment):
Pretty-print summary JSON:
More examples (skip ingestion, quality sweeps): references/benchmark-execution.md.
evaluate_rag.py; it does not substitute for custom offline judges or non-RAG benchmarks.NVIDIA_API_KEY; empty contexts yield partial RAGAS metrics (see references).references/ to keep routing concise; read those files when the user needs step-by-step conversion, full flags, or error tables.| Error / signal | Likely cause | What to do |
|---|---|---|
Immediate exit mentioning | Missing or invalid key | Set key via secure channel; see credential hygiene in |
| Wrong JSON shape | Top-level array of objects; validate per |
Fewer rows in | Per-query failures | Check stderr: network or stream JSON errors; see error table in benchmark-execution. |
Empty | Retrieval gap | Verify collection, ingestion, |
Ingestor 404 on upload | Bad ingestor base URL | Pass |
Full signal table: references/benchmark-execution.md#common-error-cases-and-signals.
scripts/eval/evaluate_rag.py assume this; a wrong directory silently breaks imports.--ingestor_server_url: pass http://host:port without /v1—the code appends /v1/ automatically. Including /v1 causes 404s on ingestor calls.APP_VECTORSTORE_URL, embedding model).--model / --llm_endpoint: forwarded verbatim only when explicitly set; omit to keep the server's configured LLM.--force_ingestion. Use --collection with a unique name when comparing quality across isolated runs.generated_contexts are empty, RAGAS scores only nv_accuracy and leaves the other two metrics blank—this is not a silent success.| Piece | Location |
|---|---|
Driver |
|
Human README (always in-repo) |
|
Full CLI (flags, defaults) |
|
Dataset / conversion | |
Runs, outputs, errors | |
Result analysis scripts | |
Latency / throughput | rag-perf skill, |
uv sync --project scripts/eval then uv run --project scripts/eval python scripts/eval/evaluate_rag.py with required --dataset-paths, --host, and --port (and env NVIDIA_API_KEY). Argument --ingestor_server_url is optional (defaults to http://localhost:8082); pass it only when overriding the ingestor endpoint.references/benchmark-execution.md: --top_k/--vdb_top_k, reranker and query-rewriting toggles, --temperature, --top-p, --max-tokens.references/dataset-and-conversion.md.references/result-analysis.md; quick scan: python3 -m json.tool results/<dataset>/rag_<dataset>_evaluation_summary.json.references/benchmark-execution.md#common-error-cases-and-signals.Get started with chainctlchainctl skill install public/nvidia/rag-eval:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/nvidia/skills/rag-eval:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
eval/h100.json
eval/nvidia_hosted.json
references/benchmark-execution.md
references/dataset-and-conversion.md
references/evaluate-rag-cli.md
references/result-analysis.md
skill-card.md
skill.oms.sig